How to Set Up MFA in Microsoft 365 for Australian Small Business

Enabling multi-factor authentication (MFA) in Microsoft 365 is the most effective single action an Australian small business can take to protect against account compromise — and you can complete the initial setup in under 30 minutes.

This guide walks through three approaches in order of simplicity: Security Defaults, per-user MFA, and Conditional Access. Choose the method that matches your Microsoft 365 plan and the level of control you need.

Before you begin, check the free SMB cyber security assessment to see how MFA fits into your broader security posture. If you want to understand why MFA is the highest-priority control for Australian small businesses, the practical baseline guide covers the full context.

What You Need Before You Start

• Global Administrator access to your Microsoft 365 tenant
• A list of all user accounts — including shared mailboxes and service accounts
• A communication plan to notify staff before you enforce MFA (allowing at least 48 hours for enrolment)
• Identification of any applications or integrations that use basic authentication (username and password without MFA)

Method 1: Security Defaults (Recommended for New Tenants)

Security Defaults is a pre-configured set of identity policies maintained by Microsoft. It enforces MFA for all users, blocks legacy authentication, and requires MFA for privileged actions. It is included in every Microsoft 365 plan at no additional cost.

Use Security Defaults when:

• Your tenant has never had Conditional Access policies configured
• You are on Microsoft 365 Business Basic or Business Standard (no Conditional Access licence)
• You want to be operational in under five minutes with zero configuration

Do not use Security Defaults when:

• You already have Conditional Access policies in place (the two cannot coexist)
• You need to exclude specific users or applications from MFA requirements
• You need different MFA requirements for different user groups

Steps to Enable Security Defaults

1. Sign in to the Microsoft Entra admin centre with a Global Administrator account
2. Navigate to Identity > Overview > Properties
3. Scroll to the bottom of the Properties page and select Manage security defaults
4. In the side panel, set Security defaults to Enabled
5. Select Save

Microsoft will now require all users to register for MFA within 14 days of their next sign-in. During this grace period, they can skip registration but will be prompted each time they sign in. After 14 days, registration becomes mandatory.

After enabling: Monitor the Sign-in logs in the Entra admin centre for any failed authentications caused by legacy authentication being blocked. Go to Identity > Monitoring and health > Sign-in logs, and filter by Client app to identify any basic authentication attempts.

Method 2: Per-User MFA (Granular Rollout Control)

Per-user MFA is the legacy approach to enabling MFA in Microsoft 365. It predates Conditional Access and Security Defaults, but is still available and useful for phased rollouts or when you want to enforce MFA for specific accounts before enabling it tenant-wide.

Use per-user MFA when:

• You want to onboard staff in batches rather than all at once
• You need to pilot MFA with a small group before a full rollout
• You are on a plan without Conditional Access and need more control than Security Defaults provides

Limitation: Per-user MFA does not automatically block legacy authentication. If a user has MFA enabled but also has a device or application using basic authentication, that connection bypasses MFA entirely. You must separately configure a policy to block legacy auth.

Steps to Enable Per-User MFA

1. Sign in to the Microsoft 365 admin centre with a Global Administrator account
2. Navigate to Users > Active users
3. Select the Multi-factor authentication button in the toolbar (you may need to select the three-dot menu if the toolbar is narrow)
4. In the multi-factor authentication page, select the users you want to enable MFA for
5. In the right panel, select Enable under quick steps
6. Confirm by selecting enable multi-factor authentication

Repeat for each user or batch of users. The affected users will be prompted to register their MFA method on next sign-in.

Blocking Legacy Authentication Separately

If you use per-user MFA rather than Security Defaults, you must also block legacy authentication explicitly:

1. In the Microsoft Entra admin centre, go to Identity > Protection > Conditional Access
2. Create a new policy named "Block legacy authentication"
3. Under Users, select All users
4. Under Cloud apps, select All cloud apps
5. Under Conditions > Client apps, select Other clients (this targets legacy authentication protocols)
6. Under Grant, select Block access
7. Enable the policy and save

Note: Conditional Access requires Microsoft 365 Business Premium or an Azure AD P1 licence.

Method 3: Conditional Access (Recommended for Business Premium)

Conditional Access is Microsoft's policy engine for identity and access. It is the most capable and flexible approach to MFA enforcement, and it is included in Microsoft 365 Business Premium — which is the plan Educ4te recommends for Australian SMBs as the minimum baseline for Essential Eight alignment.

Conditional Access lets you:

• Require MFA only when specific conditions are met (unfamiliar location, unmanaged device, high-risk sign-in)
• Block access entirely from unsupported platforms or high-risk locations
• Enforce compliant device requirements alongside MFA
• Target policies at specific groups rather than all users

Recommended Policies for Australian Small Business

The following three Conditional Access policies cover the core requirements for MFA compliance:

Policy 1: Require MFA for all users

1. In the Microsoft Entra admin centre, go to Identity > Protection > Conditional Access
2. Select New policy
3. Name it "Require MFA - All users"
4. Under Users, select All users; exclude your break-glass emergency access account (see note below)
5. Under Cloud apps, select All cloud apps
6. Under Grant, select Grant access then check Require multi-factor authentication
7. Set the policy to Report-only mode first, then switch to On after reviewing the impact report

Policy 2: Block legacy authentication

1. Create a new policy named "Block legacy authentication"
2. Under Users, select All users
3. Under Conditions > Client apps, enable the condition and select Exchange ActiveSync clients and Other clients
4. Under Grant, select Block access
5. Enable immediately — legacy authentication has no legitimate use case in 2026

Policy 3: Require MFA for administrator roles

1. Create a new policy named "Require MFA - Administrators"
2. Under Users, select Directory roles and choose all administrator roles (Global Administrator, Exchange Administrator, SharePoint Administrator, and so on)
3. Under Cloud apps, select All cloud apps
4. Under Grant, select Require multi-factor authentication and optionally Require compliant device
5. Enable the policy

Break-Glass Emergency Access Accounts

Before enabling Conditional Access, create at least two break-glass accounts:

1. Create two new user accounts with names like [email protected]
2. Assign the Global Administrator role to both accounts
3. Generate long, random passwords (at least 32 characters) and store them in two separate physically secure locations — do not store them only digitally
4. Exclude these accounts from all Conditional Access policies using an exclusion group
5. Set up monitoring alerts in Entra to notify you immediately if either account is used

These accounts exist solely to recover your tenant if MFA configuration locks out all administrators. They should never be used for day-to-day administration.

Communicating the Change to Staff

MFA rollouts fail most commonly because staff are not prepared. Send a communication at least 48 hours before enforcement:

1. Explain what MFA is and why the business is implementing it
2. Provide step-by-step instructions to download and set up the Microsoft Authenticator app on their phone
3. Specify the deadline for completing registration
4. Identify who to contact if they have difficulty — typically a helpdesk contact or manager
5. Confirm that existing passwords do not change — only the sign-in process adds a step

Setting Up the Microsoft Authenticator App (User Instructions)

Share these steps with your staff:

1. Download Microsoft Authenticator from the App Store (iOS) or Google Play Store (Android)
2. On their computer, go to https://aka.ms/mfasetup and sign in with their Microsoft 365 account
3. Select Add sign-in method and choose Authenticator app
4. Select Download now if the app is not yet installed, then select Next
5. Open the Authenticator app on their phone, tap the + icon, and select Work or school account
6. Tap Scan a QR code and scan the QR code displayed on the computer screen
7. Enter the verification code shown in the app to confirm the pairing
8. Select Next and complete the verification test
9. Select Done — MFA registration is complete

Instruct staff to also register a backup authentication method (a mobile phone number) in case they lose access to the Authenticator app.

Verifying Your MFA Rollout

After enabling MFA, verify the rollout is complete:

1. In the Microsoft Entra admin centre, go to Identity > Users > All users
2. Select Per-user MFA or review the Authentication methods report
3. Filter for users with MFA status Disabled or Enabled but not enforced — follow up with these users directly
4. In the Sign-in logs, confirm that recent successful sign-ins show MFA satisfied in the authentication details
5. Run a test sign-in from a private browsing window to confirm the MFA prompt appears as expected

After MFA: What to Do Next

MFA is the most important single control, but it is one layer in a broader security posture. Once MFA is enabled and verified, the next priorities for an Australian small business are:

• Verify automatic software updates are enabled and current on all devices (see the full SMB cyber security checklist for a complete list of controls)
• Implement verified, isolated backups for all critical business data
• Configure email authentication records (SPF, DKIM, DMARC) to protect your domain from impersonation
• Train staff to recognise phishing and verify unusual requests by phone

For a structured view of where your business stands across all of these areas, the free SMB cyber security assessment scores your current posture and produces a prioritised recommendations report in under 15 minutes.